Civic Action Toolbox — Privacy Policy

Reviewed and approved by Planet Detroit on August 19, 2026. This

document is under review by our legal counsel (Lawyers for Reporters);

if that review results in changes, we will update this page and note

the new date here.

Effective date: August 19, 2026

The Civic Action Toolbox is operated by Planet Detroit, a nonprofit environmental newsroom in Detroit, Michigan. We built this product for fellow journalists, and we hold ourselves to the privacy standards we'd want from a tool we use. The short version:

• We collect only what we need to run the service.
• No third-party analytics or ad trackers run inside the app.
• Embeds on newsroom sites set no cookies and collect no names, IP profiles, or cross-site identifiers. Clicks and reader responses record the browser user-agent string, used only to filter out bots.
• We don't sell personal information. Ever.

This policy covers two very different groups of people, so it's organized that way: app users (newsroom staff who sign in to app.civicactiontoolbox.org) and readers (people who encounter a civic action box embedded on a newsroom's website).

1. What we collect

From app users (newsroom staff)

Account identity. When you sign in with MuckRock Accounts, MuckRock sends us your name, email address, avatar, and organization membership (organization name, its unique ID, whether you're an org admin, and verified-journalist status). During our interim email sign-in period, we collect just your email address.

In-app activity. We log how the app is used: sign-ins, AI analyses run, boxes created, exported, and published, and drafts saved — each tied to your account, your organization, and a timestamp. This logging is first-party (our own database, no outside analytics service) and exists to keep the product healthy, enforce plan limits, and report to funders — see "How we use it."

Billing. Payments are processed by Stripe. Stripe collects your card details directly; we never see or store your card number. We keep your subscription plan and status.

Customer content. Article text you submit for analysis, civic action box drafts, and local civic data your team enters (meetings, organizations, comment periods). This content belongs to you; we store and process it only to provide the service.

From readers of newsroom websites (via embeds)

Civic action boxes embedded on a newsroom's site interact with readers in three narrow ways:

1. Link clicks. Action links route through our redirect so we can count clicks. We log which newsroom, which box, which section and item, the destination URL, a timestamp, and the reader's browser user-agent string — then send the reader on their way. The user-agent is there for one reason: crawlers and preview bots click links too, and counting them would inflate a newsroom's numbers. It is not combined with anything else and is not used to identify or profile readers.
2. Impressions. A lightweight beacon tells us a box was viewed. It records the newsroom, the box, and a timestamp — no cookies, no device fingerprinting, no reader personal information — and it fails silently if it can't reach us, so it never breaks the page.
3. Reader responses. Boxes may include a voluntary form where readers can tell the newsroom what civic action they took. We store the free-text response the reader chooses to write and, if they choose to leave one, their email address, associated with the newsroom and box. Readers decide what to share; the form doesn't require a name or email. We also record the browser user-agent string with the submission, for the same bot-filtering reason as clicks. (If a reader includes personal details in their free-text answer, we treat the submission as the newsroom's data and handle deletion requests accordingly.)

We do not build reader profiles, we do not track readers across sites, and we report reader activity only in aggregate.

2. How we use it

• To provide the service — running AI analyses, saving your drafts, rendering your embeds, syncing your account with MuckRock.
• To enforce plan limits — AI analysis caps are counted from the activity log.
• To show you your own analytics — your team's activity and your readers' aggregate engagement (impressions, clicks, reported actions) appear in your dashboard. You see your own organization's data only, never another customer's.
• To keep the product healthy — spotting which features get used, which newsrooms have gone quiet, and where things break.
• To report our impact — to funders and partners (like the RJI fellowship), we report usage only in aggregate: "N newsrooms built N boxes," never individual user activity.
• To communicate with you — service announcements, billing notices, and support replies.
• To improve AI matching — article text is sent to our AI provider (Anthropic) to generate suggestions. We use Anthropic's API under its Commercial Terms of Service, which provide that "Anthropic may not train models on Customer Content from Services" (§ B, effective June 17, 2025). Consumer Claude terms, which allow training, do not apply to API use.

We do not use your data for advertising, and we do not sell it.

3. What we share, and with whom

We share data only with the service providers ("processors") that run the product, and only what each needs:

| Provider | What they do for us | What they handle | |---|---|---| | Supabase | Database hosting | Account data, content, activity logs, embed metrics | | Vercel | App hosting | Traffic passing through the app | | Railway | Civic data + analysis service | Civic data processing; article text submitted for analysis | | Stripe | Payments | Billing details (card numbers stay with Stripe) | | Anthropic | AI analysis | Article text submitted for analysis | | MuckRock | Sign-in | Your MuckRock account identity | | Sentry | Error monitoring | Crash reports from our code. Configured to strip request bodies, cookies, headers, and user identity — so no article text and no personal data |

Beyond these processors, we disclose personal information only if required by law (and we'll tell you if we legally can), to protect the safety or rights of users, or — with notice — if the Toolbox is transferred as part of a reorganization of Planet Detroit's operations.

Within your organization: your teammates and org admins can see your activity in your shared workspace. Other customers never can.

4. How long we keep it

• Account and content data: for as long as your account is active. After account deletion, we remove it from live systems promptly, with backup copies expiring on their normal schedule (typically within about 90 days).
• Article text held by our AI provider: when we send article text to Anthropic for analysis, Anthropic deletes it from its systems on its own standard schedule — within 30 days of receipt. Deleting your content from our systems does not reach copies already aged out, or still aging out, there.
• Activity logs and embed metrics: kept in identifiable form only as long as needed for billing, analytics, and reporting; long-term reporting uses aggregate numbers.
• Reader response submissions: kept so the newsroom can see and use them; deleted on request from the newsroom or the reader.
• Billing records: kept as long as tax and accounting rules require.

5. Your choices and rights

• Access and export: ask us for a copy of your data — account info, content, and analytics — and we'll provide it in a reasonable machine-readable format.
• Correction: account identity comes from MuckRock, so name/email updates happen in your MuckRock account and sync to us. Anything else, ask us.
• Deletion: ask us to delete your account or your organization's data and we will, subject to the retention notes above.
• Readers: if you encountered a civic action box on a news site and want a form submission removed, email us — from the address you left with it, or with enough detail to find it — and we'll delete the submission and any email address you gave.
• Email: we send service and billing emails, not marketing blasts. Any optional announcements will have an unsubscribe link.

Send any request to hello@civicactiontoolbox.org. We'll respond within 30 days, and we don't discriminate against anyone for exercising a privacy right.

US state privacy laws (CCPA and similar). Depending on your state, you may have formal rights to know, access, correct, and delete personal information, and to opt out of "sales" or "sharing" of it. For clarity: we do not sell personal information and do not share it for cross-context behavioral advertising, so there's nothing to opt out of — and the access, correction, and deletion rights above are available to everyone, not just residents of states that mandate them.

Outside the US. The Toolbox is built for US newsrooms and hosted in the United States. If you use it from elsewhere (including the EU/UK), your data is processed in the US. We honor access and deletion requests from anyone, wherever they are.

6. Security

Data is encrypted in transit, access is restricted by role and by tenant (each newsroom's workspace is isolated from every other's, enforced server-side and covered by automated tests), and payment card data never touches our servers. No system is perfectly secure, but if a breach ever affects your personal information, we'll notify you as required by law — and honestly, because you're our peers.

7. Children

The Civic Action Toolbox is a professional tool for newsrooms and is not directed at children under 13. We don't knowingly collect personal information from children. If you believe a child has submitted personal information to us (for example, through a reader response form), contact us and we'll delete it.

8. Changes to this policy

If we change this policy in a meaningful way — collecting something new, sharing with someone new — we'll notify app users by email and post the updated policy with a new effective date before it takes effect. Minor clarifications may be posted without separate notice. Previous versions are available on request.

9. Contact

Planet Detroit — operator of the Civic Action Toolbox Detroit, Michigan hello@civicactiontoolbox.org

We're a small nonprofit newsroom. A real person reads this inbox.